Privacy Policy

Effective Date: 04 MAY 2026
Last Updated: 04 MAY 2026

This Privacy Policy describes how GXP AI LLC d/b/a “GxP Prep AI” (“Company,” “we,” “us,” or “our”) collects, uses, and shares information about you in connection with the websites, applications, and services we operate at gxpprep.com (collectively, the “Service”). This Privacy Policy is incorporated into and forms part of our Terms of Service. The Service is intended for business use by professionals working in or supporting GxP-regulated activities.

1. Summary.

(a) We do not retain documents you upload after we deliver your audit-preparation document. We use the term “Inputs” to refer to documents you upload, and “Output” to refer to the document we deliver back to you.

(b) We retain a limited amount of operational data, including account information, billing records, and usage logs.

(d) We do not use Inputs or Outputs to train our own AI models.

(e) Inputs should not include PHI, payment-card data, government identifiers, or other restricted data.

(f) You can contact us at support@gxpprep.com with questions or requests.

2. Information We Collect.

2.1 Account Information. When you register, we collect your name, email address, and the password you choose. If you sign up on behalf of an organization, we collect the organization name and the names and emails of authorized users you invite.

2.2 Billing Information. When you subscribe, our payment processor, Stripe, Inc., collects your payment information directly. We receive only billing metadata (such as billing address, transaction amount, transaction ID, and payment status); we do not receive or store full payment-card numbers.

2.3 Inputs. When you use the Service, you upload or submit documents and other materials for processing. These are processed in memory by the Service and our AI subprocessors and are not retained by us after Output is delivered, except for short-term operational logs that may incidentally reference Input metadata such as file name, file size, or processing timestamp.

2.4 Outputs. Outputs are delivered to you and are not retained by us after delivery, except as noted in Section 2.3 [Inputs].

2.5 Usage and Device Data. When you interact with the Service, we automatically collect technical information including IP address, browser type, device identifiers, pages or features accessed, dates and times of access, and similar log information.

2.6 Communications. If you contact us by email or through the Service, we retain a record of that communication and any information you provide.

3. How We Use Information.

We use the information described above to:

(a) provide, operate, and maintain the Service;

(b) process Inputs and generate Outputs;

(d) bill for and process payment for the Service;

(e) communicate with you about the Service, including notices, updates, and support;

(f) analyze and improve performance, security, and features of the Service in aggregate or de-identified form;

(g) comply with applicable law and respond to lawful requests from authorities; and

(h) detect, prevent, or investigate fraud, abuse, or violations of our terms.

We do not use Inputs or Outputs to train our own AI models. We do not sell personal information.

Separately from our use of personal information described above, we may derive aggregated and de-identified data from operation of the Service and use it for any lawful purpose. Aggregated and de-identified data is, and will be maintained by us, in a form that does not identify and cannot reasonably be used to identify any individual.

4. AI Processing and Subprocessors.

The Service relies on third-party providers to operate. The principal providers are:

(a) Anthropic provides the large language model used to generate Outputs. Input text transits the Anthropic API for processing. Anthropic’s handling of API data is governed by Anthropic’s commercial terms and privacy policies.

(b) OpenAI provides the embedding API used for citation verification and vector search. Limited Input text and reference text transit the OpenAI API for processing. OpenAI’s handling of API data is governed by OpenAI’s API terms and policies.

(c) Supabase, Inc. provides authentication and database services (Americas region) for account information and operational metadata.

(d) Vercel, Inc. provides hosting infrastructure for the Service.

(e) Stripe, Inc. processes payments and manages subscription billing.

(f) Processing Location. Account information, billing metadata, and operational logs are processed and stored on infrastructure operated by our subprocessors located in the United States. Inputs transit the application programming interfaces of Anthropic and OpenAI for in-memory processing; those providers may process Inputs in the United States or in other jurisdictions in accordance with their own policies.

We may add or replace subprocessors from time to time. Material changes will be reflected in this Privacy Policy. We have arrangements with our AI subprocessors that, as of the Effective Date set forth above, do not authorize those providers to use API submissions to train their generally available models. Your Inputs are subject to those providers’ own terms and policies once transmitted.

5. How We Share Information.

We share information in the following limited circumstances:

(a) with our subprocessors listed in Section 4 [AI Processing and Subprocessors], solely to operate the Service;

(b) with professional advisors (such as lawyers, accountants, and auditors), under appropriate confidentiality obligations;

(c) in response to a lawful request from a government authority or in connection with legal process, when we believe in good faith that disclosure is required;

(d) to enforce our terms, protect our rights and the rights of users, or investigate suspected fraud or abuse; and

(e) in connection with a merger, acquisition, financing, or sale of all or a portion of our business, subject to the receiving party’s commitment to maintain comparable protection of personal information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

6. Data Retention.

We retain different categories of information for different periods:

(a) Inputs and Outputs: Not retained after Output delivery, except for short-term in-memory processing.

(b) Account information: Retained for the life of the account, plus a reasonable period after deletion to comply with legal obligations and resolve disputes.

(c) Billing records: Retained as required by tax, accounting, and other applicable legal requirements (generally seven (7) years).

(d) Usage logs: Retained for a limited period to support security, debugging, and operational analytics, generally up to ninety (90) days in detailed form, and longer in aggregated form.

(e) Communications: Retained for a reasonable period to support customer service and dispute resolution.

You may request deletion of your account at any time as described in Section 8 [Your Choices and Rights].

7. Data Security.

7.1 Safeguards. We use commercially reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit, encryption at rest for stored operational data, access controls, and infrastructure provided by our subprocessors. No system is perfectly secure, and we cannot guarantee the security of any information transmitted to or from the Service.

7.2 Breach Notification. In the event we determine that a security incident has resulted in unauthorized access to or disclosure of personal information about you, we will notify you and applicable regulators as required by, and within the timeframes set by, applicable law. Our notice obligations are limited to the persons and information for which notice is required under applicable law.

8. Your Choices and Rights.

8.1 Account Information. You may access, correct, or update your account information through the Service or by contacting us at support@gxpprep.com.

8.2 Account Deletion. You may request deletion of your account by contacting us. We will delete account information within a reasonable period after the request, subject to retention obligations described in Section 6 [Data Retention].

8.3 Marketing Communications. We may send you communications about the Service, including transactional messages such as account confirmations, billing receipts, password resets, and security or service notifications. From time to time, we may also send promotional or marketing communications regarding new features, product updates, or related offerings. You may opt out of promotional or marketing communications at any time by following the unsubscribe instructions in any such message or by contacting us at support@gxpprep.com. We will continue to send transactional messages necessary to provide the Service.

8.4 Cookies and Similar Technologies. We use a limited set of cookies and similar technologies to operate the Service. These include (a) session cookies, which are deleted when you close your browser and are necessary for authentication, and (b) persistent cookies, which remain on your device for a limited period and are used for authentication continuity and basic site functionality. We do not use third-party advertising cookies and we do not engage in cross-context behavioral advertising. We do not currently use third-party analytics or tracking tools. Because there is no industry consensus on responses to “Do Not Track” signals, the Service does not respond to DNT signals.

8.5 California Residents. This Section 8.5 supplements the rest of this Privacy Policy and applies to California residents whose personal information is collected through the Service.

(a) Categories of Personal Information. In the preceding 12 months, we have collected the following categories of personal information from California residents: identifiers (such as name, email address, IP address, account ID); commercial information (subscription tier and billing metadata received from our payment processor); internet or other electronic network activity information (such as browser type, pages visited, and interactions with the Service); geolocation information (general, derived from IP address); professional or employment-related information (such as employer name and role, where provided); and inferences drawn from the foregoing for the purpose of operating and improving the Service.

(b) Sources. We collect personal information directly from you when you register and use the Service, automatically when you interact with the Service, and from our payment processor and other subprocessors as described in Section 4 [AI Processing and Subprocessors].

(c) Purposes. We use personal information to provide and operate the Service, authenticate users, process payment, communicate with you, secure the Service, comply with legal obligations, and improve the Service.

(d) Recipients. We disclose personal information only to the categories of recipients identified in Section 5 [How We Share Information].

(e) Sale or Sharing. We do not “sell” personal information and we do not “share” personal information for cross-context behavioral advertising, in each case as those terms are defined under the California Consumer Privacy Act (“CCPA”). We have no actual knowledge of selling or sharing the personal information of any individual under 16 years of age.

(f) Sensitive Personal Information. The only category of “sensitive personal information” we collect is account login credentials. We use this category only as reasonably necessary to authenticate users and operate the Service, and we do not use it for the purpose of inferring characteristics about you.

(g) Retention. We retain personal information for the periods described in Section 6 [Data Retention].

(h) Your CCPA Rights. Subject to verification of your identity and applicable exceptions, you have the right to (i) request to know the categories and specific pieces of personal information we have collected about you, (ii) request that we delete personal information we have collected from you, (iii) request that we correct inaccurate personal information we maintain about you, and (iv) opt out of any sale or sharing of personal information for cross-context behavioral advertising (which we do not engage in). You may also designate an authorized agent to make a request on your behalf. We will not discriminate against you for exercising your CCPA rights.

(i) How to Exercise Your Rights. To exercise any of these rights, contact us at support@gxpprep.com. We will respond within the timeframes required by the CCPA.

8.6 Other U.S. State Privacy Rights. If you are a resident of another U.S. state with a comprehensive privacy law (including, where applicable, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia), you may have rights similar to those described in Section 8.5 [California Residents], including rights to access, delete, or correct personal information about you, and to opt out of certain processing activities. To exercise any such rights, contact us at support@gxpprep.com. We will respond within the timeframes required by applicable law.

8.7 EEA, UK, and Swiss Residents. If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following supplements this Privacy Policy.

(a) Legal Bases. We process personal information based on (i) the necessity of processing to perform our contract with you, (ii) our legitimate interests in operating, securing, and improving the Service (where those interests are not overridden by your rights and freedoms), (iii) compliance with legal obligations, and (iv) where applicable, your consent.

(b) Your Rights. Subject to applicable law, you have the right to access, correct, delete, restrict, or object to processing of personal information about you; the right to data portability; and the right to withdraw consent (where processing is based on consent), without affecting the lawfulness of prior processing. To exercise any of these rights, contact us at support@gxpprep.com.

(c) International Transfers. The Service is operated from the United States, and personal information is processed by our subprocessors located in the United States and, in the case of Anthropic and OpenAI, in such other jurisdictions as those providers may operate. Where required by applicable law, we rely on appropriate safeguards for cross-border transfers, including the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, and the Swiss equivalent, as applicable.

(d) Supervisory Authority. You have the right to lodge a complaint with a data protection supervisory authority in your country of residence. We encourage you to contact us first at support@gxpprep.com so we can address your concerns directly.

9. Information We Do Not Want.

The Service is not designed to receive certain categories of sensitive information. Please do not submit:

(a) protected health information (“PHI”) subject to HIPAA;

(b) payment-card data subject to PCI DSS, other than what you enter directly into Stripe’s hosted payment page;

(d) data subject to U.S. export controls, including ITAR-controlled or EAR-restricted technical data; or

(e) data the disclosure of which to our subprocessors would violate applicable law or contract.

We are not a HIPAA business associate, and we do not enter into business associate agreements absent a separate written arrangement.

10. Children’s Privacy.

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us so we can delete it.

11. Changes to this Policy.

We may update this Privacy Policy from time to time. Material changes will be reflected by the “Last Updated” date above and, where appropriate, communicated by email or in-product notice.

12. Contact.

If you have questions or requests regarding this Privacy Policy or our privacy practices, please contact us at:

GXP AI LLC d/b/a GxP Prep AI
865 NJ 33 Business, Suite 3, Unit #182, Freehold, NJ 07728
support@gxpprep.com